19 ms·

The register article on this https://www.theregister.com/2021/02/11/microsoft_azure_ubuntu_data_sharing/ https://www.theregister.com/2021/02/11/microsoft_azure_

The register article on this https://www.theregister.com/2021/02/11/microsoft_azure_ubuntu_data_sharing/ https://www.theregister.com/2021/02/11/microsoft_azure_ubunt... has responses from Canonical and MS, which shed a bit more light on the situation. The Canonical quote is the most illuminating :- "As per the Azure T&Cs, Microsoft shares with Canonical, the publisher of Ubuntu, the contact details of developers launching Ubuntu instances on Azure. These contact details are held in Canonical’s CRM in accordance with privacy rules. "On February 10th, a new Canonical Sales Representative contacted one of these developers via LinkedIn, with a poor choice of word. In light of this incident, Canonical will be reviewing its sales training and policies."

IgorPartola 6y ago
Wow. I just lost a whole lot of respect for Canonical. “If you read the document we expect nobody to read, you’d know that you sold your soul to us. We didn’t mean for you to find that out but one of our salespeople got overeager and tried to sell you your soul back. He will be reprimanded. Can we all forget about this real quick?”
- rkangel 6y ago
  This was my first response as well (it's not the data sharing that's the problem, it's that you noticed). Thinking about it though, a lot of it is a question of surprise and unknowns. I would find this message to be a lot better - "We see that you've taken advantage of the Ubuntu image that Canonical provide in the Azure Marketplace. I am available to you for (etc.)".
  - inetknght 6y ago
    > * I would find this message to be a lot better - "We see that you've taken advantage of the Ubuntu image* No. That's not better at all. The mere fact that Canonical has specific information to reach me when I am not a direct customer of Canonical is a complete violation of my privacy. Ubuntu is a free product. Canonical should not be able to find out if I (specifically me or my organization) allocates or runs 1 or 10000 instances of Ubuntu.
    - ethbr0 6y ago
      The alternative is that Azure owns complete access to the customer. Which seems... well, an easy skip to App Store-esque rent seeking. So MS sharing "their" customer details with the image provider seems more generous than evil. Provided there's a "Do not share" config option somewhere.
      - Blikkentrekker 6y ago
        The issue is more so *why* Microsoft is sharing this information with Canonical. — what does it obtain from it? Ubuntu is gratis, so Canonical can't have coerced Microsoft into doing so; it is quite probable that one approached the other to make a deal, and that Canonical is paying a certain fee for this information.
        kube-system 6y ago
        The code is gratis. Although, partnership deals tend to go beyond simply sharing code, and into the realm of dedicating time and resources to working with each other.
        wizzwizz4 6y ago
        The code is more than just gratis; it's libre. This is Ubuntu, based on Debian GNU/Linux. (Yeah, okay, some of the code is merely gratis, but most of it is libre.) I don't expect an OS based on an OS based on an OS based on a half-finished OS based on free software principles to have shady data-dealing attached, yet hidden from the people whose data is being dealt.
        moron4hire 6y ago
        You might not have expected it, but privacy protection is not any sort of obligation encoded in any extant concept of Free Software.
        6y ago
- badjeans 6y ago
  Why Canonical? Isn't this a Microsoft feature?
  - detaro 6y ago
    How is a Canonical rep contacting him purely a "Microsoft feature"?
    - inetknght 6y ago
      It means that Microsoft is providing information that they shouldn't.
      - detaro 6y ago
        And Canonical decided to take that data, search him on Linkedin and contact him. Seems reasonable to see that as a reason to loose respect for Canonical over.
        inetknght 6y ago
        Don't get me wrong, what Canonical has done here also isn't good. But what they've done shouldn't have been possible because Microsoft shouldn't have given Canonical the information in the first place.
        bigbizisverywyz 6y ago
        The question I have is what's in it for Microsoft, why did they even bother to do this in the first place? I can't believe there would be that big of a cash incentive.
        foolmeonce 6y ago
        If this were Windows, I would expect Microsoft to pass it to an internal department that sells higher service contracts and then off to 3rd parties that provide the same for up to a week after you find the "don't share my data" checkbox. That (enterprise support) is a very important side business. Whether they got cash from other OSes or just set it up the same to fight an eventual Anti-Trust Case is anyone's guess.
- znpy 6y ago
  > one of our salespeople got overeager and tried to sell you your soul back. He will be reprimanded. I wonder what have the consequences been for that guy.
  - dylan604 6y ago
    Probably a promotion for failing upwards. At least, that's how precedence makes me feel about it.
  - bregma 6y ago
    Probably a "graduate trainee" who got a stern talking-to.
- SilasX 6y ago
  >one of our salespeople got overeager and tried to sell you your soul back. He will be reprimanded. I don't think the (non-)apology even gave that much, just that the training/policies will be "reviewed", which is even weaker: >>In light of this incident, Canonical will be reviewing its sales training and policies.
  - IgorPartola 6y ago
    I speak enough corporate to know that this guy gets to be chewed out. They singled him out in their response and said he was new. If they stood behind this policy they would have basically diffused the responsibility without mentioning him by specifically. I could be wrong of course, but he cost a bunch of people a bunch of time and effort and unpleasantness so he'll get yelled at.
    - rchaud 6y ago
      They singled him out because the original tweet showed the salesperson's full name and picture. He might lose his job because he unintentionally showed everyone how the sausage of monetizing open source is made.
- yellowapple 6y ago
  Canonical's been scummy for about a decade now. This is the same company that shoved Amazon results into local desktop searches, then responded to criticisms of that with "Don't trust us? We have root.". Pretty ironic considering the meaning of the word "ubuntu".
- aruggirello 6y ago
  I'm all for Occam's Razor and don't usually buy corporate bullshit, but this comes to my mind: - Azure is the second largest cloud provider worldwide - Ubuntu is probably the most common Linux distro installed in the cloud - We never heard about another episode like this before Now if Canonical was allowing / encouraging this kind of behavior from their sales rep, I think we should have seen it happen in the wild before (like, a thousand times?) already; since it only happened once, I'm inclined to believe them. Also see [1] Now let me think: I'm not OK with Canonical accessing my contact information because I spin up a VM, but I'm also not OK with Microsoft sharing my contact information with Canonical. What's wrong with "let me call them if and when I need?" But I'm European so maybe a little too privacy focused. [1] BTW: let's say 99% Ubuntu VMs are spun to host some boring Wordpress site, nuvelle cuisine blog or leather shoe shop. What's the chance of an Ubuntu sales representative to ever make a sale this way? I guess it must be pretty slim, so he'd have to contact hundreds of potential customers to turn a few sales - something that would quickly get reported if it was a corporate business habit. This reinforces my first impression.
  - hn_throwaway_99 6y ago
    I feel like you're missing the point. I wholeheartedly believe Canonical does not encourage this kind of behavior from their sales rep, but only because it makes it obvious that they're getting data from MS they really have no right to access, when they really intend for it to just stay hidden behind some voluminous terms of service. You know what they say, the definition of "gaffe" is when someone tells the truth.
  - bialpio 6y ago
    We haven't heard about it before because other sales reps didn't admit to knowing that a customer has deployed something, and reached out to the customers under the guise of standard-looking sales pitch that got dismissed as regular kind of spam. That would be my take on it.
- hardolaf 6y ago
  You had respect for Canonical after they put ads in the OS?
markild 6y ago
Great, so their conclusion is "we should make this less obvious and creepy", not "we should probably stop doing this".
- hackcasual 6y ago
  That's marketing
- macksd 6y ago
  My first thought was that companies that are selling complementary services (and that's really the difference between Debian and Ubuntu here) are obviously going to have mutually beneficial affiliate agreements. The vast majority of us are probably working at companies that do that. Someone mentioned Oracle licensing enforcement and yeah, I wouldn't feel like a victim if I used bootleg copies of Oracle and the bootleg copy told them without me expecting it. I think in this case it should be clearer and opt out, but honestly - who among us is the least bit surprised that Canonical at least gets some referral here? But where they specifically went wrong? Well one of them was absolutely the way the "point of contact" reached out. If my professional email was shared with you as part of a professional agreement, adding it to a mailing list to sell me on the paid version of what I used for free makes sense. Sending some of those specific details to my personal account, which by the way you aren't sure is actually me, is way over the line. The salesperson personally screwed up big time there for sure. The other thing is the granularity of the data, and that's also over the line. I read that agreement and think sure - they'll know our company has used their company. But specific actions taken by specific developers? There are users that avoid certain providers like the plague because in some way they're competitive, and even if they trust them not to directly compromise security measures, interfere and steal data - they still don't want a competitive company having insight into their costs, development, traffic, etc. This kills the trust you may have in Microsoft from that standpoint.
- michaelt 6y ago
  Once you decide your cloud platform will include a marketplace for paid, licensed enterprise software, this doesn't surprise me all that much (although it kinda sucks) I mean, is it even possible to buy an Oracle license without Oracle knowing who you are?
toyg 6y ago
"oops, our dirty secret is out. But we won't do it again, guv!"
duxup 6y ago
I think the Marketplace quote is worth noting too: >A look at the terms for the Azure Marketplace throws up this sentence: "If you purchase or use a Marketplace Offering, we may share with the Publisher of such Offering your contact information and details about the transaction and your usage." So the publisher of something on their Marketplace gets some information. This doesn't seem 'that' weird (well the linked in contact does) as it seems semi related to ... say apps and app stores and etc. Edit: I'm not justifying the policy, but I am noting that on a marketplace with third parties, this seems pretty standard / something you should always consider when you install something from a third party.
- joezydeco 6y ago
  This is the real answer. I almost did the same thing but decided to spin up my own image instead of buying a prepacked one from the Marketplace.
  - duxup 6y ago
    Exactly, I'm not so much cool with the policy here, but absolutely we should think about what we want and take appropriate actions like you did if we want to avoid it.
    - joezydeco 6y ago
      Well, my reason was also because I was having so much trouble trying to find a machine+zone+disk setup that was available and under my $50/month budget since I'm running on MSDN subscription credit. What a freaking pain in the ass.
- IgorPartola 6y ago
  You buy a dishwasher from Best Buy. They send your name and address to Maytag. You buy soap from Walmart. They send your name and address to Johnson & Johnson. You buy a sandwich at your local deli. They send your name and address to Boar’s Head. Cool?
  - 6y ago
rkangel 6y ago
Actually, to me the MS statement is the most illuminating and I'm guessing that Canonical is getting some grumpy calls from Microsoft. This is the last part of the Microsoft statement: "Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes" Canonical then tells us that this person was a Sales Representative, and it is clear from the content that this is a message aimed towards selling. Canonical has broken Microsoft's terms. That said, I can't see where that legal restriction is (e.g. can't see anything like that in https://azure.microsoft.com/en-us/support/legal/marketplace-terms/ https://azure.microsoft.com/en-us/support/legal/marketplace-...).
- jacurtis 6y ago
  > "On February 10th, a new Canonical Sales Representative contacted one of these developers via LinkedIn, with a poor choice of word. In light of this incident, Canonical will be reviewing its sales training and policies." The part I find the most enlightening (ie: disturbing) is that Canonical's only regret is that the sales rep used "a poor choice of word" and they will train their salespeople better. I assume the "poor choice of word" was when the salesman said, "I saw that you spun up an Ubuntu instance". Was Canonical's biggest regret that the salesmen INFORMED the user that they are monitoring installs and linking them to contact information? Canonical never said "oh the salesperson wasn't supposed to market to you with this information", instead they basically said, the salesman wasn't supposed to TELL YOU that we are monitoring what you install and linking it to personal contact details.
  - thom_nic 6y ago
    > the salesman wasn't supposed to TELL YOU that we are monitoring what you install Exactly. The old "I'm sorry I got caught" and not "I'm sorry I did it."
    - reaperducer 6y ago
      We can do better™
peanut_worm 6y ago
Looks like i’m switching to Debian this weekend, what a stupid company lol
curtis3389 6y ago
We all know that you can't trust Microsoft, but a lot of people blindly trust Canonical just because they create a Linux distro. I haven't trusted Canonical since I noticed their pattern of creating competing alternatives to new Linux standards instead of helping them (Mir & Wayland, Snap & Flatpack, Unity & Gnome 3). It'd be one thing if they were bringing better ideas and long-term support to their alternatives, but they just seem to be half-baked copies. I appreciate all they've done for the Linux ecosystem, but I'll stick with my Debian.
- andagainagain 6y ago
  Mir and WAyland was because wayland couldn't do what they wanted technically. Snap came BEFORE flatpak. Flatpak was the "new competing standard" in that situation. And Gnome shell, quite frankly, sucked. IMO it still sucks, but back then it sucked WAY worse.
  - toyg 6y ago
    Yeah, I wouldn't put down Ubuntu's traditional attitude as "we'll copy something so we can own it" - it's more of a "we'll do whatever we think is better for the experience we provide, screw the community". Which is still misguided and fundamentally doomed to fail in the long run, but not as malicious as, say, Apple's moves. At the end of the day the scorecard reads: - Mir: failed - Unity: failed - Snap: mostly failing Meanwhile RedHat takes over stuff that doesn't work, makes it work a bit better, and pushes it on the whole ecosystem as "the" solution. And they win, and win, and win.
    - O_H_E 6y ago
      > - Snap: mostly failing As much as I hate Snap and remove it from my Kubuntu systems, I don't see where it is failing. I frankly see a lot more non-linux-focused vendors support to snap than flatpak. Could you expand on that point?
      - toyg 6y ago
        It took years to get any sort of buy-in from app-developers, and I know quite a few users who are actively running from it. Just last week I helped a friend who was surprised and somewhat disgusted by the fact that certbot seems to have embraced it. It’s not a question of which one will succeed between snap and flatpak, it’s whether the ecosystem really needs either one of those.
andagainagain 6y ago
Per the Azure's T&C? It's easy to blame Canonical here... but I that sounds like Azure's screw up, and Canonical accidentally revealing it.
Waterluvian 6y ago
Forgive me. It's Friday. What was the poor choice of word? I get that the whole concept is poor. But what word or words?
- cowflik 6y ago
  "I saw that you" (did something that you didn't expect me to see)
  - Waterluvian 6y ago
    So the poor word choice was revealing how he knew to reach out? So it's that he got caught?
Abishek_Muthian 6y ago
I wonder whether the LinkedIn profile of the customer was directly handed out to the Canonical by MS, because invite by email on LinkedIn cannot send 'custom invite message', Canonical Agent seems to have manually sent an invite with custom message which leaves us with two possibilities - 1. Agent had enough details at hand to confirm that the LinkedIn profile was indeed that of the customer. 2. Access to LinkedIn profile itself (e.g. profile URL). If 2. how did MS make that association? AFAIK there's no mechanism for the user to connect LinkedIn profile to Azure or vice versa. P.S. I know MS owns LinkedIn.
- detaro 6y ago
  He stated the LinkedIn profile was under a different email (makes sense, not corporate one). I'd guess 1: name+company matching was enough.
  - hobofan 6y ago
    Isn't that even possibly illegal? I mean contacting someone on a personal channel for unsolicited B2B sales?
    - gowld 6y ago
      How is LinkedIn a "personal" channel, and why would it be illegal anyway? Direct marketing isn't illegal.
      - hobofan 6y ago
        Depending on the jurisdiction it might be. E.g. in Germany cold calls (actual phone calls) even for B2B are only legal under certain conditions (generally either preexisting registration of intent, or if it's common in the specific industry). I'm not sure what the regulations regarding cold e-mail or messaging are, though.
    - adambyrtek 6y ago
      Sadly, I get B2B marketing spam like that all the time as CTO, so I'm definitely not as shocked as others in this thread.
ec109685 6y ago
A T&C is a terrible place to put this in. This should work like an account linking flow (e.g. sign on with Apple to a site), where Apple lists everything they share explicitly when you click login.
fortran77 6y ago
Given that "everyone" in the community probably blocked this guy on LinkedIn, I'm not sure he's going to have much luck as a salesman going forward.
ThePhysicist 6y ago
Damn, I wasn't aware that they share this kind of information. Luckily I'm in Europe and I think here they'd need at least an additional opt-in to do stuff like that. That said I have to say "No thank you, please don't send all my data to the cloud" at least 5 times when installing Windows 10 these days, so I'm sure they definitely try. I haven't used Azure in a while though so I can't be sure. That's also why I use Sublime Text instead of VS Code and run a private Gitlab instance instead of developing on Github (barring open-source work, which I do in the open anyway), as I'm pretty sure MSFT will find an excuse to mine my telemetry data for their own benefit eventually.
- GekkePrutser 6y ago
  Even here in Europe privacy laws are much lighter when it comes to B2B stuff. It's actually legal to send unsolicited spam to business emails sadly.
alxlaz 6y ago
Azure is... really weird like that. Sometimes it feels like I'm working with Amway, not Microsoft. A few months ago I spent like a week or two playing with Azure Sentinel -- I'm a contractor for a company that develops some security solutions, and I was trying to see if and how the feature I was working on could be integrated with a SIEM. Sentinel, of course, was one of 'em. So I do my thing, then a few weeks pass, then out of the blue, one afternoon, my phone rings... ...and there's a Microsoft representative at the other end, asking me what I thought about Sentinel, if I encountered any difficulties with it, what my plans are and so on. She seemed to be working off a full report of my usage, too, as the questions were pretty specific. Thing is, my total usage of Microsoft Azure Sentinel was on the order of, what, 16-20 hours? spread across several months. I don't think I've issued 50 request in total, and I would've issued less than 5 if Log Analytics didn't take like forever to show my data on the free tier (not that I'm complaining, the price is unbeatable :P). I was on the free tier the whole time, it seemed like such a gimmick that I didn't even bother going through the company I was doing all this for. Either the Azure team is desperate for customers or they have more salespeople than Oracle has lawyers if they ended up calling a small fish like me.
- closeparen 6y ago
  Microsoft is trying to position Azure into the world currently dominated by contractors visiting the Windows Server closets of Main Street businesses. This is how that world works.
waynesonfire 6y ago
Under CCPA, can CA residents opt out of this?
ljm 6y ago
Sending out a cold email is one thing (most of that ends up in spam anyway), but why the fuck are these people taking the contact details and plugging them into a social network? I don't agree with any of it, it's a violation of trust and burying it in small print doesn't change that. But having people reach out on their personal networks takes the cake.
richardfey 6y ago
"privacy rules" is incorrect wording. You better say privacy legislation in this case.

IgorPartola 6y ago

Wow. I just lost a whole lot of respect for Canonical. “If you read the document we expect nobody to read, you’d know that you sold your soul to us. We didn’t mean for you to find that out but one of our salespeople got overeager and tried to sell you your soul back. He will be reprimanded. Can we all forget about this real quick?”

rkangel 6y ago
This was my first response as well (it's not the data sharing that's the problem, it's that you noticed). Thinking about it though, a lot of it is a question of surprise and unknowns. I would find this message to be a lot better - "We see that you've taken advantage of the Ubuntu image that Canonical provide in the Azure Marketplace. I am available to you for (etc.)".
- inetknght 6y ago
  > * I would find this message to be a lot better - "We see that you've taken advantage of the Ubuntu image* No. That's not better at all. The mere fact that Canonical has specific information to reach me when I am not a direct customer of Canonical is a complete violation of my privacy. Ubuntu is a free product. Canonical should not be able to find out if I (specifically me or my organization) allocates or runs 1 or 10000 instances of Ubuntu.
  - ethbr0 6y ago
    The alternative is that Azure owns complete access to the customer. Which seems... well, an easy skip to App Store-esque rent seeking. So MS sharing "their" customer details with the image provider seems more generous than evil. Provided there's a "Do not share" config option somewhere.
    - Blikkentrekker 6y ago
      The issue is more so *why* Microsoft is sharing this information with Canonical. — what does it obtain from it? Ubuntu is gratis, so Canonical can't have coerced Microsoft into doing so; it is quite probable that one approached the other to make a deal, and that Canonical is paying a certain fee for this information.
      - kube-system 6y ago
        The code is gratis. Although, partnership deals tend to go beyond simply sharing code, and into the realm of dedicating time and resources to working with each other.
        wizzwizz4 6y ago
        The code is more than just gratis; it's libre. This is Ubuntu, based on Debian GNU/Linux. (Yeah, okay, some of the code is merely gratis, but most of it is libre.) I don't expect an OS based on an OS based on an OS based on a half-finished OS based on free software principles to have shady data-dealing attached, yet hidden from the people whose data is being dealt.
        moron4hire 6y ago
        You might not have expected it, but privacy protection is not any sort of obligation encoded in any extant concept of Free Software.
        6y ago
badjeans 6y ago
Why Canonical? Isn't this a Microsoft feature?
- detaro 6y ago
  How is a Canonical rep contacting him purely a "Microsoft feature"?
  - inetknght 6y ago
    It means that Microsoft is providing information that they shouldn't.
    - detaro 6y ago
      And Canonical decided to take that data, search him on Linkedin and contact him. Seems reasonable to see that as a reason to loose respect for Canonical over.
      - inetknght 6y ago
        Don't get me wrong, what Canonical has done here also isn't good. But what they've done shouldn't have been possible because Microsoft shouldn't have given Canonical the information in the first place.
        bigbizisverywyz 6y ago
        The question I have is what's in it for Microsoft, why did they even bother to do this in the first place? I can't believe there would be that big of a cash incentive.
        foolmeonce 6y ago
        If this were Windows, I would expect Microsoft to pass it to an internal department that sells higher service contracts and then off to 3rd parties that provide the same for up to a week after you find the "don't share my data" checkbox. That (enterprise support) is a very important side business. Whether they got cash from other OSes or just set it up the same to fight an eventual Anti-Trust Case is anyone's guess.
znpy 6y ago
> one of our salespeople got overeager and tried to sell you your soul back. He will be reprimanded. I wonder what have the consequences been for that guy.
- dylan604 6y ago
  Probably a promotion for failing upwards. At least, that's how precedence makes me feel about it.
- bregma 6y ago
  Probably a "graduate trainee" who got a stern talking-to.
SilasX 6y ago
>one of our salespeople got overeager and tried to sell you your soul back. He will be reprimanded. I don't think the (non-)apology even gave that much, just that the training/policies will be "reviewed", which is even weaker: >>In light of this incident, Canonical will be reviewing its sales training and policies.
- IgorPartola 6y ago
  I speak enough corporate to know that this guy gets to be chewed out. They singled him out in their response and said he was new. If they stood behind this policy they would have basically diffused the responsibility without mentioning him by specifically. I could be wrong of course, but he cost a bunch of people a bunch of time and effort and unpleasantness so he'll get yelled at.
  - rchaud 6y ago
    They singled him out because the original tweet showed the salesperson's full name and picture. He might lose his job because he unintentionally showed everyone how the sausage of monetizing open source is made.
yellowapple 6y ago
Canonical's been scummy for about a decade now. This is the same company that shoved Amazon results into local desktop searches, then responded to criticisms of that with "Don't trust us? We have root.". Pretty ironic considering the meaning of the word "ubuntu".
aruggirello 6y ago
I'm all for Occam's Razor and don't usually buy corporate bullshit, but this comes to my mind: - Azure is the second largest cloud provider worldwide - Ubuntu is probably the most common Linux distro installed in the cloud - We never heard about another episode like this before Now if Canonical was allowing / encouraging this kind of behavior from their sales rep, I think we should have seen it happen in the wild before (like, a thousand times?) already; since it only happened once, I'm inclined to believe them. Also see [1] Now let me think: I'm not OK with Canonical accessing my contact information because I spin up a VM, but I'm also not OK with Microsoft sharing my contact information with Canonical. What's wrong with "let me call them if and when I need?" But I'm European so maybe a little too privacy focused. [1] BTW: let's say 99% Ubuntu VMs are spun to host some boring Wordpress site, nuvelle cuisine blog or leather shoe shop. What's the chance of an Ubuntu sales representative to ever make a sale this way? I guess it must be pretty slim, so he'd have to contact hundreds of potential customers to turn a few sales - something that would quickly get reported if it was a corporate business habit. This reinforces my first impression.
- hn_throwaway_99 6y ago
  I feel like you're missing the point. I wholeheartedly believe Canonical does not encourage this kind of behavior from their sales rep, but only because it makes it obvious that they're getting data from MS they really have no right to access, when they really intend for it to just stay hidden behind some voluminous terms of service. You know what they say, the definition of "gaffe" is when someone tells the truth.
- bialpio 6y ago
  We haven't heard about it before because other sales reps didn't admit to knowing that a customer has deployed something, and reached out to the customers under the guise of standard-looking sales pitch that got dismissed as regular kind of spam. That would be my take on it.
hardolaf 6y ago
You had respect for Canonical after they put ads in the OS?

markild 6y ago

Great, so their conclusion is "we should make this less obvious and creepy", not "we should probably stop doing this".

hackcasual 6y ago
That's marketing
macksd 6y ago
My first thought was that companies that are selling complementary services (and that's really the difference between Debian and Ubuntu here) are obviously going to have mutually beneficial affiliate agreements. The vast majority of us are probably working at companies that do that. Someone mentioned Oracle licensing enforcement and yeah, I wouldn't feel like a victim if I used bootleg copies of Oracle and the bootleg copy told them without me expecting it. I think in this case it should be clearer and opt out, but honestly - who among us is the least bit surprised that Canonical at least gets some referral here? But where they specifically went wrong? Well one of them was absolutely the way the "point of contact" reached out. If my professional email was shared with you as part of a professional agreement, adding it to a mailing list to sell me on the paid version of what I used for free makes sense. Sending some of those specific details to my personal account, which by the way you aren't sure is actually me, is way over the line. The salesperson personally screwed up big time there for sure. The other thing is the granularity of the data, and that's also over the line. I read that agreement and think sure - they'll know our company has used their company. But specific actions taken by specific developers? There are users that avoid certain providers like the plague because in some way they're competitive, and even if they trust them not to directly compromise security measures, interfere and steal data - they still don't want a competitive company having insight into their costs, development, traffic, etc. This kills the trust you may have in Microsoft from that standpoint.
michaelt 6y ago
Once you decide your cloud platform will include a marketplace for paid, licensed enterprise software, this doesn't surprise me all that much (although it kinda sucks) I mean, is it even possible to buy an Oracle license without Oracle knowing who you are?

toyg 6y ago

"oops, our dirty secret is out. But we won't do it again, guv!"

duxup 6y ago

I think the Marketplace quote is worth noting too: >A look at the terms for the Azure Marketplace throws up this sentence: "If you purchase or use a Marketplace Offering, we may share with the Publisher of such Offering your contact information and details about the transaction and your usage." So the publisher of something on their Marketplace gets some information. This doesn't seem 'that' weird (well the linked in contact does) as it seems semi related to ... say apps and app stores and etc. Edit: I'm not justifying the policy, but I am noting that on a marketplace with third parties, this seems pretty standard / something you should always consider when you install something from a third party.

joezydeco 6y ago
This is the real answer. I almost did the same thing but decided to spin up my own image instead of buying a prepacked one from the Marketplace.
- duxup 6y ago
  Exactly, I'm not so much cool with the policy here, but absolutely we should think about what we want and take appropriate actions like you did if we want to avoid it.
  - joezydeco 6y ago
    Well, my reason was also because I was having so much trouble trying to find a machine+zone+disk setup that was available and under my $50/month budget since I'm running on MSDN subscription credit. What a freaking pain in the ass.
IgorPartola 6y ago
You buy a dishwasher from Best Buy. They send your name and address to Maytag. You buy soap from Walmart. They send your name and address to Johnson & Johnson. You buy a sandwich at your local deli. They send your name and address to Boar’s Head. Cool?
- 6y ago

rkangel 6y ago

Actually, to me the MS statement is the most illuminating and I'm guessing that Canonical is getting some grumpy calls from Microsoft. This is the last part of the Microsoft statement: "Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes" Canonical then tells us that this person was a Sales Representative, and it is clear from the content that this is a message aimed towards selling. Canonical has broken Microsoft's terms. That said, I can't see where that legal restriction is (e.g. can't see anything like that in https://azure.microsoft.com/en-us/support/legal/marketplace-terms/ https://azure.microsoft.com/en-us/support/legal/marketplace-...).

jacurtis 6y ago
> "On February 10th, a new Canonical Sales Representative contacted one of these developers via LinkedIn, with a poor choice of word. In light of this incident, Canonical will be reviewing its sales training and policies." The part I find the most enlightening (ie: disturbing) is that Canonical's only regret is that the sales rep used "a poor choice of word" and they will train their salespeople better. I assume the "poor choice of word" was when the salesman said, "I saw that you spun up an Ubuntu instance". Was Canonical's biggest regret that the salesmen INFORMED the user that they are monitoring installs and linking them to contact information? Canonical never said "oh the salesperson wasn't supposed to market to you with this information", instead they basically said, the salesman wasn't supposed to TELL YOU that we are monitoring what you install and linking it to personal contact details.
- thom_nic 6y ago
  > the salesman wasn't supposed to TELL YOU that we are monitoring what you install Exactly. The old "I'm sorry I got caught" and not "I'm sorry I did it."
  - reaperducer 6y ago
    We can do better™

peanut_worm 6y ago

Looks like i’m switching to Debian this weekend, what a stupid company lol

curtis3389 6y ago

We all know that you can't trust Microsoft, but a lot of people blindly trust Canonical just because they create a Linux distro. I haven't trusted Canonical since I noticed their pattern of creating competing alternatives to new Linux standards instead of helping them (Mir & Wayland, Snap & Flatpack, Unity & Gnome 3). It'd be one thing if they were bringing better ideas and long-term support to their alternatives, but they just seem to be half-baked copies. I appreciate all they've done for the Linux ecosystem, but I'll stick with my Debian.

andagainagain 6y ago
Mir and WAyland was because wayland couldn't do what they wanted technically. Snap came BEFORE flatpak. Flatpak was the "new competing standard" in that situation. And Gnome shell, quite frankly, sucked. IMO it still sucks, but back then it sucked WAY worse.
- toyg 6y ago
  Yeah, I wouldn't put down Ubuntu's traditional attitude as "we'll copy something so we can own it" - it's more of a "we'll do whatever we think is better for the experience we provide, screw the community". Which is still misguided and fundamentally doomed to fail in the long run, but not as malicious as, say, Apple's moves. At the end of the day the scorecard reads: - Mir: failed - Unity: failed - Snap: mostly failing Meanwhile RedHat takes over stuff that doesn't work, makes it work a bit better, and pushes it on the whole ecosystem as "the" solution. And they win, and win, and win.
  - O_H_E 6y ago
    > - Snap: mostly failing As much as I hate Snap and remove it from my Kubuntu systems, I don't see where it is failing. I frankly see a lot more non-linux-focused vendors support to snap than flatpak. Could you expand on that point?
    - toyg 6y ago
      It took years to get any sort of buy-in from app-developers, and I know quite a few users who are actively running from it. Just last week I helped a friend who was surprised and somewhat disgusted by the fact that certbot seems to have embraced it. It’s not a question of which one will succeed between snap and flatpak, it’s whether the ecosystem really needs either one of those.

andagainagain 6y ago

Per the Azure's T&C? It's easy to blame Canonical here... but I that sounds like Azure's screw up, and Canonical accidentally revealing it.

Waterluvian 6y ago

Forgive me. It's Friday. What was the poor choice of word? I get that the whole concept is poor. But what word or words?

cowflik 6y ago
"I saw that you" (did something that you didn't expect me to see)
- Waterluvian 6y ago
  So the poor word choice was revealing how he knew to reach out? So it's that he got caught?

Abishek_Muthian 6y ago

I wonder whether the LinkedIn profile of the customer was directly handed out to the Canonical by MS, because invite by email on LinkedIn cannot send 'custom invite message', Canonical Agent seems to have manually sent an invite with custom message which leaves us with two possibilities - 1. Agent had enough details at hand to confirm that the LinkedIn profile was indeed that of the customer. 2. Access to LinkedIn profile itself (e.g. profile URL). If 2. how did MS make that association? AFAIK there's no mechanism for the user to connect LinkedIn profile to Azure or vice versa. P.S. I know MS owns LinkedIn.

detaro 6y ago
He stated the LinkedIn profile was under a different email (makes sense, not corporate one). I'd guess 1: name+company matching was enough.
- hobofan 6y ago
  Isn't that even possibly illegal? I mean contacting someone on a personal channel for unsolicited B2B sales?
  - gowld 6y ago
    How is LinkedIn a "personal" channel, and why would it be illegal anyway? Direct marketing isn't illegal.
    - hobofan 6y ago
      Depending on the jurisdiction it might be. E.g. in Germany cold calls (actual phone calls) even for B2B are only legal under certain conditions (generally either preexisting registration of intent, or if it's common in the specific industry). I'm not sure what the regulations regarding cold e-mail or messaging are, though.
  - adambyrtek 6y ago
    Sadly, I get B2B marketing spam like that all the time as CTO, so I'm definitely not as shocked as others in this thread.

ec109685 6y ago

A T&C is a terrible place to put this in. This should work like an account linking flow (e.g. sign on with Apple to a site), where Apple lists everything they share explicitly when you click login.

fortran77 6y ago

Given that "everyone" in the community probably blocked this guy on LinkedIn, I'm not sure he's going to have much luck as a salesman going forward.

ThePhysicist 6y ago

Damn, I wasn't aware that they share this kind of information. Luckily I'm in Europe and I think here they'd need at least an additional opt-in to do stuff like that. That said I have to say "No thank you, please don't send all my data to the cloud" at least 5 times when installing Windows 10 these days, so I'm sure they definitely try. I haven't used Azure in a while though so I can't be sure. That's also why I use Sublime Text instead of VS Code and run a private Gitlab instance instead of developing on Github (barring open-source work, which I do in the open anyway), as I'm pretty sure MSFT will find an excuse to mine my telemetry data for their own benefit eventually.

GekkePrutser 6y ago
Even here in Europe privacy laws are much lighter when it comes to B2B stuff. It's actually legal to send unsolicited spam to business emails sadly.

alxlaz 6y ago

Azure is... really weird like that. Sometimes it feels like I'm working with Amway, not Microsoft. A few months ago I spent like a week or two playing with Azure Sentinel -- I'm a contractor for a company that develops some security solutions, and I was trying to see if and how the feature I was working on could be integrated with a SIEM. Sentinel, of course, was one of 'em. So I do my thing, then a few weeks pass, then out of the blue, one afternoon, my phone rings... ...and there's a Microsoft representative at the other end, asking me what I thought about Sentinel, if I encountered any difficulties with it, what my plans are and so on. She seemed to be working off a full report of my usage, too, as the questions were pretty specific. Thing is, my total usage of Microsoft Azure Sentinel was on the order of, what, 16-20 hours? spread across several months. I don't think I've issued 50 request in total, and I would've issued less than 5 if Log Analytics didn't take like forever to show my data on the free tier (not that I'm complaining, the price is unbeatable :P). I was on the free tier the whole time, it seemed like such a gimmick that I didn't even bother going through the company I was doing all this for. Either the Azure team is desperate for customers or they have more salespeople than Oracle has lawyers if they ended up calling a small fish like me.

closeparen 6y ago
Microsoft is trying to position Azure into the world currently dominated by contractors visiting the Windows Server closets of Main Street businesses. This is how that world works.

waynesonfire 6y ago

Under CCPA, can CA residents opt out of this?

ljm 6y ago

Sending out a cold email is one thing (most of that ends up in spam anyway), but why the fuck are these people taking the contact details and plugging them into a social network? I don't agree with any of it, it's a violation of trust and burying it in small print doesn't change that. But having people reach out on their personal networks takes the cake.

richardfey 6y ago

"privacy rules" is incorrect wording. You better say privacy legislation in this case.